Characterizing secret leakage in public GitHub repositories

Re:Characterizing secret leakage in public GitHub repositories by 7ewis on Monday April 08, 2019 @04:00PM (#19608508)

I wrote a tool that scans all the new commits to our Org for passwords/secrets.

Webhook > AWS API Gateway > Lambda

The Lambda uses the new(ish) Layers feature so it can use Git. I then use the truffleHog[0] library to scan for entropy/regexes inside the commit.

If something is detected, it posts to an SNS topic, which is currently subscribed to by another Lambda that posts an alert to my team and the Security team's Slack channel.

It then calls the GitHub API to make the repo private to limit the exposure.

[0] - https://github.com/dxa4481/truffleHog

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by semi-extrinsic on Monday April 08, 2019 @05:27PM (#19609217)

Why not have a pre-commit hook clientside that runs truffleHog AND if successful generates some form of file indicating it was run, then have a serverside hook checking for that file? This should be doable even with plain Github/etc, no?

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by waffleguy on Monday April 08, 2019 @07:05PM (#19610009)

That was too simple to think of ;)

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by ithkuil on Tuesday April 09, 2019 @12:05AM (#19611700)

How do you install serverside hooks in GitHub?

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by waffleguy on Tuesday April 09, 2019 @07:31PM (#19620087)

I’m sorry! I didn’t realize my screen name said google

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by ithkuil on Wednesday April 10, 2019 @06:40PM (#19629444)

I'm sorry! I realized my question sounded as if I was asking instructions about how to do something that was possible but I didn't know how to do it.

Rephrasing:

What if you use a git server like GitHub that doesn't allow you to install server side hooks?

[ Parent | on HN ]

Re:Characterizing secret leakage in public GitHub repositories by pry_or on Tuesday April 09, 2019 @02:08PM (#19617431)

I assume you saw the note on truffleHog in the article? The paper found it to be rather inaccurate outside of the basics (mainly AWS keys). Hopefully the authors open source their stuff.

[ Parent | on HN ]